To help users bypass Windows 8 Secure Boot, Fedora will develop boot loader, shell out $99 for Microsoft's signing service

Fedora is shelling out $99 on Red Hat Fedora users' behalf to run the OS on Windows 8-certified computers to bypass Microsoft's new UEFI Secure Boot feature, according to Red Hat Linux developer Matthew Garrett. That, he said, is the best compromise the company could devise to ensure users could easily load Fedora on new PCs without giving itself an unfair edge over less-influential Linux vendors.

Red Hat's plans, as outlined in Garrett's personal blog, have generated considerable ire from members of the Linux community. In response to Garrett's post, critics have accused Red Hat of "selling out" to Microsoft in paying to access the company's signing service to allow users to run Fedora.

UEFI, which Microsoft touts as a more secure alternative to BIOS, requires an OS to furnish a digital key before it's loaded by the machine. UEFI blocks the operations of any programs or drivers unless they've been signed by the key, thus preventing malware from changing the boot-loading process. Microsoft is requiring hardware vendors to enable secure boot on any Windows 8-certified machine, which means each system will come preloaded with the necessary key to let the OS safely boot.

Garrett garnered fame back in September 2011 when he accused Microsoft of using its next-generation computing boot-loading technology to lock Linux and other OSes out of Windows 8-certified machines. But according to Garrett, Red Hat had limited alternatives in providing a way for users to boot Fedora on Windows 8 machines.

Option one was to produce a Fedora-specific key and encourage hardware vendors to incorporate it. Red Hat turned down this approach for two reasons, according to Garrett: First, the company determined "there was no realistic chance we could get all of them to carry it. That would mean going back to the bad old days of scouring compatibility lists before buying hardware, and that's fundamentally user-hostile," he wrote.

Second, it would put Fedora in a "privileged position" because Red Hat provides one of the larger Linux distributions and has more leverage with hardware manufacturers. The company did not want to exploit that position at the expense of other Linux distros. "Systems with a Fedora key would boot Fedora fine, but would they boot Mandriva? Arch? Mint? Mepis? Adopting a distribution-specific key and encouraging hardware companies to adopt it would have been hostile to other distributions. We want to compete on merit, not because we have better links to OEMs," he wrote.

Another option: Developing an overall Linux key for all distros. Doing so is not feasible, according to Garrett, because it would require finding an entity willing take responsibility for maintaining the key. "That means having the ability to keep the root key absolutely secure and perform adequate validation of people asking for signing. That's expensive. Like millions of dollars expensive," he wrote. "It would also take a lot of time to set up, and that's not really time we had. And, finally, nobody was jumping at the opportunity to volunteer. So no generic Linux key."

Thus, Red Hat will likely go with what Garrett described as "the least worst" option: Developing a boot loader that will be signed by a Microsoft key via Microsoft's signing services. Registering the boot loader will cost Fedora a one-time fee of $99 -- which would go to VeriSign, not Microsoft.

Red Hat's first-stage boot loader will be a simple one with the sole function of loading a real boot loader. That, in turns, gets signed with a Fedora signing key. "Using the Fedora signing key there means that we can build grub updates in our existing build infrastructure and sign them ourselves. The first stage bootloader should change very rarely, and we don't envisage updating it more than once per release cycle. It shouldn't be much of a burden on release management," Garrett wrote.

Defending the decision, Garrett said that using Microsoft's key is "cheaper than any realistic alternative would have been. It ensures compatibility with as wide a range of hardware as possible and it avoids Fedora having any special privileges over other Linux distributions. If there are better options then we haven't found them."

Garrett's blog post has attracted more than 130 comments thus far, many critical of Red Hat's plans. "The minute a Linux vendor sells out -- like this -- is the minute we're all doomed," read one anonymous comment. "Microsoft will lead them on for a couple of years, and then quietly insist that x86 vendors comply with the same restrictions that ARM vendors have already kowtowed to -- at which point, only Red Hat Linux will boot and run. No others, at least not until all of the others also sign up and pay MS for permission to run non-MS software on end-user hardware."

Correction: This article has been corrected from its original version. Fedora is paying the one-time fee to Microsoft to run Red Hat on Windows 8 machines. Users will not have to cover the cost, as first stated.